GCP Storage buckets are publicly accessible to all users misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_114
Category - Subcategory	Public Exposure - Storage Buckets
Provider	GCP
Severity	HIGH
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	41f7a4b1-cad6-4fbf-b698-1fd11a8869a8

Impact

This rule reviews if a Google Cloud Storage bucket is safeguarded against public access. It essentially checks if measures to prevent public access are enforced on these storage buckets. If storage buckets are left publicly accessible, sensitive and private data stored within them could be exposed to unauthorized users. This potentially leads to data breaches, sabotage, or the unlawful use of this data. Therefore, this rule ensures these storage buckets are secured and not vulnerable to such risks.

How to Fix

Resource: google_storage_bucket

• Arguments: public_access_prevention

To fix the identified issue, you should ensure the "public_access_prevention" setting is enabled for your Google Cloud Storage bucket. This would help to protect your bucket from unintentional or unauthenticated public access.

Here is an example:

The above code sets 'public_access_prevention' to 'enforced' for the Google Cloud Storage bucket. This enables public access prevention, so the Google Cloud Storage bucket cannot be accessed publicly. [source,go]

resource "google_storage_bucket" "example_bucket" { name = "example_bucket" location = "US" uniform_bucket_level_access = true bucket_policy_only = true iam_configuration { uniform_bucket_level_access { enabled = true } public_access_prevention = "enforced" } }